CVE-2025-66467

Katalog CVE

CVSS 8.1 · High EPSS 0,37%

Kerentanan Incomplete Cleanup pada apache cloudstack. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-459: Incomplete Cleanup

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/05/09/4 mailing list · advisory pihak ketiga